Login fails (the shaking window) in Open Directory setup

(I get the spinning beach ball thing and then of course my favourite, the shaking window)

This behavior can be the result of changing the server's hostname after initial setup. I would check the following:

1. You may have already done this, but: On the server and one a test client, use lookupd -d to find your server:

a. Verify address to name resolution:
lookupd -d then

hostWithInternetAddress: <server's IP> and press return

Look for the server's DNS name after name

b. Verify name to address resolutioin:
lookupd -d then

hostWithName: <server's DNS name> and press return

Look for the server's primary IP after ip_address

Judging by your post, you've probably already accomplished the preceding.

2. Check server's hostname:

a. On your server, edit the /etc/hostconfig file: sudo pico /etc/hostconfig. Look for the HOSTNAME line. The value for HOSTNAME should be your server's DNS name.

Note that the default server configuration is to use the -AUTOMATIC- variable (e.g., HOSTNAME=-AUTOMATIC-), where the hostname is determined by the first true item in this list: the DHCP client ID for the server, the name returned by reverse DNS lookup, the local host name (the Bonjour name), the string "localhost". I recommend changing the HOSTNAME entry to read HOSTNAME=<your server's DNS name> (e.g., HOSTNAME=server.company.private).

b. On the server, type hostname at a local Terminal or remote ssh session. Verify that it returns the server's DNS name. If it does not, change it by typing sudo hostname <server's DNS name>, then verifying with hostname again.

3. Ensure that the following ports are open for your network on your server's firewall: AFP, DNS, all LDAP, all NetInfo, all RPC and authentication services, all Password Server, and all Kerberos.

4. If you've recently changed your server's hostname and haven't run the changeip command, do so now to update your server's Open Directory database. Note that changeip won't actually change your server's IP address:

sudo changeip /LDAPv3/127.0.0.1 <server's IP address> <server's IP address again> <old hostname> <new hostname>

You will be prompted to enter a directory administrator's name and password.

5. Check Kerberos status: Open Server Admin, log on to your server, and click Open Directory. In the status section, verify that Kerberos is running. If it's not, click Settings, then click Kerberize in the Role section. Enter the directory administrator's name and password to start Kerberos.

Note that if the server's hostname command previously returned a local host name (that is, a host name from Bonjour), then Kerberos didn't start previously.

6. Enable single-sign-on: Vist http://docs.info.apple.com/article.html?artnum=302044 and enter the last two commands listed in step 5 there. These are the two commands that involve sso_util.

7. Refresh automounts stored in the Open Directory domain: For some reason, I've had to perform this additional step in situations where the login window failed to authenticate one or all users after the changes listed above.

With no users connected, open Workgroup Manager and log on to your server. Click Sharing, then select each share point that has a corresponding automount record and un-check the "share this item" box. You'll be asked to authenticate as a directory administrator so that the corresponding mount record will be deleted. Click Apply. Then, locate and re-check the "share this item" box for each previously-defined share point. Click Network Mount and recreate the appropriate mount record for the share point. Be sure that you perform this procedure for network home directory share points as well as static automounts, such as a shared Library.

8. Check home and home_loc properties for a few user accounts: Using the All Records Inspector tab in Workgroup Manager, select an account and look for the two home records (NFSHomeDirectory). These should take the form of /Network/Servers/<server's DNS name>/<path>/<home directory share point>/<user name>. Also check the two home_loc records. These should indicate <url>afp://<server's DNS name>/<home directory share point></url><path><user name></path>.

You may need to use the Home tab in the Accounts section to reset the locations of user homes. You can do so en-masse if several home locations need to be updated.

9. Unbind, rebind, and restart each client: Using Directory Access, unbind and delete the LDAP configuration of your server, then rebind and restart to refresh network mounts.

10. Try logging in again.

Hope this helps!

--Gerrit

Thank you for the compliment. I'm glad the post helped. I developed the instructions while setting up DNS and Kerberos on servers that had already been configured as Open Directory masters with local (Bonjour-only) host names.

--Gerrit